Analysis
- user interaction
yes - max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/09/2026, 11:48
Behavioral task
behavioral1
Sample
ETJ-N7 Configuration Tool Windows EN20240520.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
ETJ-N7 Configuration Tool Windows EN20240520.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target ETJ-N7 Configuration Tool Windows EN20240520.exe
- Size 2.4MB
- Sample260915-nylj4sfa33
- SHA256 32cc4f0960db77deca690c5cad2a8d5a9fc51b7bc4985d5bdc4dd412ae5f75e5
- MD5 d6098009fd1b50303425b0ddd4454651
- SHA1 9d943ae00d23d0703df837b999c97e11ed776fa0
- SHA512 2c6761ed1e97efe3b3a926c220ac0b6a5a357301cab428478c92817c7f4a165aaba4c5a3c2faca5a099cf39fd7a5626e982a31e67a70ace9ef9c87e18d5d855d
- SSDEEP 49152:InsHyjtk2MYC5GDofxOVkPkuwTeKlfcdaN8:Insmtk2ahfxdPB8N8
- TLSH T10EB59D22B3819437D4732B3C9D67A3995836BF112E38A54B37E83E4C4F396817D252A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
resource behavioral2/files/0x000e00000001c42b-970.dat - Executes dropped EXE 3 IoCs
pid Process 1296 ._cache_ETJ-N7 Configuration Tool Windows EN20240520.exe 1172 Synaptics.exe 2720 Synaptics.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" ETJ-N7 Configuration Tool Windows EN20240520.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETJ-N7 Configuration Tool Windows EN20240520.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_ETJ-N7 Configuration Tool Windows EN20240520.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ Synaptics.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2416 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5608 taskmgr.exe Token: SeSystemProfilePrivilege 5608 taskmgr.exe Token: SeCreateGlobalPrivilege 5608 taskmgr.exe Token: 33 5608 taskmgr.exe Token: SeIncBasePriorityPrivilege 5608 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe 5608 taskmgr.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 5608 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4304 wrote to memory of 1296 4304 ETJ-N7 Configuration Tool Windows EN20240520.exe 89 PID 4304 wrote to memory of 1172 4304 ETJ-N7 Configuration Tool Windows EN20240520.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ETJ-N7 Configuration Tool Windows EN20240520.exe"C:\Users\Admin\AppData\Local\Temp\ETJ-N7 Configuration Tool Windows EN20240520.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\._cache_ETJ-N7 Configuration Tool Windows EN20240520.exe"C:\Users\Admin\AppData\Local\Temp\._cache_ETJ-N7 Configuration Tool Windows EN20240520.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1296
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1172
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2416
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:244
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Synaptics\Synaptics.exe
- Size 753KB
- SHA256 e1b9ea6b3b947ae18c6655cfd647f3296a90e32d65bf5e0656d1afa339561b39
- MD5 dcec1ad222f139b14db19eaa290be2bb
- SHA1 54d21b737b0cd6414596236c9fc794fba8653c8a
- SHA512 28434c4bab6a6a7e15d08c3a05514486f27a00273fbe64b98f8d2df76e27e5cf86879417a626e67d7c07b08983089d412d32d419da25d90415a60f68ebd98272
- SSDEEP 12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IKr:ansJ39LyjbJkQFMhmC+6GD9F
- TLSH T1BBF47D32F2D19437D1721A3D9C5BA3A5582ABE512E38794E3BF82E4C4F3D68139252D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\._cache_ETJ-N7 Configuration Tool Windows EN20240520.exe
- Size 1.6MB
- SHA256 87eb7580bb20ac2a985440bb27923705c6c640d2d348b99d624dc1a1ac0a6b29
- MD5 b13969888f30a8763154e9007faf25d7
- SHA1 40799475ec3c37cca19fd54c2dee58fd9ef4b00b
- SHA512 3faa4040d1fb95b9213874b7695291087856b86d3647feebaae872d006eee2c0bfc7cc1e974312a286db7b53c350f31de6e2b60a45d0cc6d6a6ff1b1773f1697
- SSDEEP 24576:KpV0xWZW5AWAi3QCNEWkk8MLys4vkSDqX5OATeKlfcdqbnNQit:KfxOVkPkuwTeKlfcdaN
- TLSH T199859C22B381983BC4732F385D17A2D96836FE211E64958B37E83F4C4F356917E352A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SjNfUTq4.xlsm
- Size 17KB
- SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
- MD5 e566fc53051035e1e6fd0ed1823de0f9
- SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
- SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
- SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
- TLSH T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SjNfUTq4.xlsm
- Size 26KB
- SHA256 9590e338fca7b51aac365b2f53045444126141709fd3708767a0283f5b044407
- MD5 6d5617ec0ea2bfa1403336801b8a82c4
- SHA1 bac1dbfe1496197b2b3ddd2d5f472061fe0dd737
- SHA512 8fba560f7cd500e7a6f2a99a38a2fc87b40f8412513699fb0f05e3b57dfc07196851d2f3f351fdacc1bd3c2274c4240c2223afa0949ee77c2bf40350bba0901f
- SSDEEP 384:MqNtu2sw8Mp+o5bL0nC1ZTc2jmbW4mE0oF77ao5mqP8/cxlnxCFIPw2AVA:MqNtuef4o5b51u2Cmy/l1PeMxCKPqVA
- TLSH T1EBC2C118E996FD3AD453D438DD0AA6EBB90775069413EBCE1522F43F86017CF236A2E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\atlantek2.ini
- Size 12KB
- SHA256 cb66e8462201745e910b02e0d3d930b1a42c76ccbaa53970d54e43ea7d23acec
- MD5 e151a3fd8b61eeab51d3c464bab070ad
- SHA1 a426f827dac6f4f5fdd666c80c9d31b31794845c
- SHA512 b701c1fd8e96ec255bfd8bc72e53b6bdae51cbeed3ad2bf18b27fcf46b1386392294cad20cc5b47940fe84f257b41b2c78b346fdb9e20d7e2b5cc0cbb86bb4ea
- SSDEEP 192:c4g+rMNPaPAIVWs8/O79U5la4XFssVp1RCmEYsg5PYdcPdK8kUUK:cY445QsOO79abllqRK
- TLSH T1B7423265A276B01E4C63D5076AE142E532F32FA4C5013AD1B32A159F3ECCDC674BAB4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\xpplatinum.ini
- Size 6KB
- SHA256 2058e696d5c3cac9412b1a98e38ff263c98a7131197ad00afaeedfc4b5a5f650
- MD5 89a1a901b4f2f7c38e6ec8bcf233baca
- SHA1 c426eaaa7ffad9e950acce22c86a92a88caebf1a
- SHA512 703e411b022790011eadfee4ab553c454b5b2921cd1b0ec8650ff8552fac2e13606f1a04e33fcd0c95872e8f4d9c0178978a5e0094d392fc96c677e1c296c37e
- SSDEEP 192:eF4g644oyxotlgCC5chZs+pwmDhopDDGgzhPOiWAWfc:eFPgPcE+bM5hWij
- TLSH T1DDE11269E236701F8837E30724A152D836F12F6185023AC472AA1DDE6EDCDC53DB9B5D
- MD5 SHA1 SHA512 SSDEEP TLSH